SharpView: (aggressor )
PowerView: (tips ) (dev: )
ADModule: (To use ActiveDirectory module without installing RSAT, we can use Import-Module for the valid ActiveDirectory module DLL)
Domain
Get Domain
PowerView ADModule
Copy Get-NetDomain
Get-NetDomain -Domain domain.local
Copy Get-ADDomain
Get-ADDomain -Identity domain.local
Get Domain SID
PowerView ADModule
Copy Get-DomainSID
Get-DomainSID -Domain domain.local
Copy (Get-ADDomain).DomainSID
(Get-ADDomain -Identity domain.local).DomainSID
Get Domain Policy
PowerView
Copy Get-DomainPolicy
(Get-DomainPolicy)."system access"
(Get-DomainPolicy –domain moneycorp.local)."system access"
Get DCs
PowerView ADModule
Copy Get-NetDomainController
Get-NetDomainController –Domain moneycorp.local
Copy Get-ADDomainController
Get-ADDomainController -DomainName moneycorp.local -Discover
Users
Get a list of users in the current domain
PowerView ADModule
Copy Get-NetUser
Get-NetUser –Username student1
Copy Get-ADUser -Filter * -Properties *
Get-ADUser -Identity student1 -Properties *
Get a list of all properties for users within domain
PowerView ADModule
Copy # Lists all properties available
Get-UserProperty
# Gets the value of a property for all users in domain
Get-UserProperty –Properties pwdlastset
Copy Get-ADUser -Filter * -Properties * | select -First 1 | Get-Member MemberType *Property | select Name
Get-ADUser -Filter * -Properties * | select name,@{expression={[datetime]::fromFileTime($_.pwdlastset)}}
Search for particular string in users attribute
PowerView ADModule
Copy Find-UserField -SearchField Description -SearchTerm "built"
Copy Get-ADUser -Filter 'Description -like "*built*"' Properties Description | select name,Description
Groups
Get all groups in current domain
PowerView ADModule
Copy Get-NetGroup
Get-NetGroup –Domain <targetdomain>
Get-NetGroup –FullData
Copy Get-ADGroup -Filter * | select Name
Get-ADGroup -Filter * -Properties *
Get all groups containing admin in current domain
PowerView ADModule
Copy Get-ADGroup -Filter 'Name -like "*admin*"' | select Name
Get members of domain admin group
PowerView ADModule
Copy Get-NetGroupMember -GroupName "Domain Admins" -Recurse
Copy Get-ADGroupMember -Identity "Domain Admins" -Recursive
Get the group membership for a user
PowerView ADModule
Copy Get-NetGroup –UserName "student1"
Copy Get-ADPrincipalGroupMembership -Identity student1
Computers / Sessions
Get a list of computers in current domain
PowerView ADModule
Copy Get-NetComputer
Get-NetComputer –OperatingSystem "*Server 2016*"
Get-NetComputer -Ping
Get-NetComputer -FullData
Copy Get-ADComputer -Filter * | select Name
Get-ADComputer -Filter 'OperatingSystem -like "*Server 2016*"' Properties OperatingSystem | select Name,OperatingSystem
Get-ADComputer -Filter * -Properties DNSHostName | %{TestConnection -Count 1 -ComputerName $_.DNSHostName}
Get-ADComputer -Filter * -Properties
List all local groups on a machine (needs admin privs to query non-dc machines)
PowerView
Copy Get-NetLocalGroup -ComputerName dcorpdc.dollarcorp.moneycorp.local -ListGroups
List members of local groups on a machine (needs admin privs on non-dc machines)
PowerView
Copy Get-NetLocalGroup -ComputerName dcorpdc.dollarcorp.moneycorp.local -Recurse
Get actively logged on users on target (needs admin rights on target)
PowerView
Copy Get-NetLoggedon –ComputerName <servername>
Get locally logged on users on target (needs remote registry enabled (started by default on servers))
PowerView
Copy Get-LoggedonLocal -ComputerName dcorpdc.dollarcorp.moneycorp.local
Get the last logged on user on target (needs admin rights and remote registry enabled)
PowerView
Copy Get-LastLoggedOn –ComputerName <servername>
Files
Find shares on hosts in current domain
PowerView
Copy Invoke-ShareFinder –Verbose
Find sensitive files on computers within domain
PowerView
Copy Invoke-FileFinder –Verbose
Get all file servers of domain
GPO / OU
Get list of GPO in current domain
PowerView ADModule
Copy Get-NetGPO
Get-NetGPO -ComputerName dcorpstudent1.dollarcorp.moneycorp.local
Copy Get-GPO -All (GroupPolicy module)
Get-GPResultantSetOfPolicy -ReportType Html -Path C:\Users\Administrator\report.html (Provides RSoP)
Get GPO which use restricted groups or groups.xml for interesting users
Get users which are in a local group of a machine using GPO
PowerView
Copy Find-GPOComputerAdmin –Computername dcorpstudent1.dollarcorp.moneycorp.local
Find machines where given user is a member of a specific group
PowerView
Copy Find-GPOLocation -UserName student1 -Verbose
Get OUs in a Domain
PowerView ADModule
Copy Get-ADOrganizationalUnit -Filter * -Properties *
Get GPO applied on an OU
PowerView ADModule
Copy Get-NetGPO -GPOname "{AB306569-220D-43FF-B03B83E8F4EF8081}"
Copy Get-GPO -Guid AB306569-220D-43FF-B03B-83E8F4EF8081 (GroupPolicy module)
ACLs
Get ACLs associated with a specific object
PowerView ADModule
Copy Get-ObjectAcl -SamAccountName student1 –ResolveGUIDs
Copy (Get-Acl 'AD:\CN=Administrator,CN=Users,DC=dollarcorp,DC=moneycorp ,DC=local').Access
Get the ACLs associated with the specific prefix to be used for search
PowerView
Copy Get-ObjectAcl -ADSprefix 'CN=Administrator,CN=Users' -Verbose
Get the ACLs associated with the specified LDAP path to be used for search
PowerView
Copy Get-ObjectAcl -ADSpath "LDAP://CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local" -ResolveGUIDs -Verbose
Search for interesting ACEs
PowerView
Copy Invoke-ACLScanner -ResolveGUIDs
Get the ACLs associated with the specified path
PowerView
Copy Get-PathAcl -Path "\\dcorp-dc.dollarcorp.moneycorp.local\sysvol"
Trusts
Domain Trust Mapping
PowerView ADModule
Copy Get-NetDomainTrust
Get-NetDomainTrust –Domain us.dollarcorp.moneycorp.local
Copy Get-ADTrust Get-ADTrust –Identity us.dollarcorp.moneycorp.local
Forest Mapping
PowerView ADModule
Copy Get-NetForest
Get-NetForest –Forest eurocorp.local
Copy Get-ADForest
Get-ADForest –Identity eurocorp.local
Get all domains in current forest
PowerView ADModule
Copy Get-NetForestDomain
Get-NetForestDomain –Forest eurocorp.local
Copy (Get-ADForest).Domains
Get all global catalogues for the current forest
PowerView ADModule
Copy Get-NetForestCatalog
Get-NetForestCatalog –Forest eurocorp.local
Copy Get-ADForest | select -ExpandProperty GlobalCatalogs
Map trusts of a forest
PowerView ADModule
Copy Get-NetForestTrust
Get-NetForestTrust –Forest eurocorp.local
Copy Get-ADTrust -Filter 'msDS-TrustForestTrustInfo -ne "$null"'
Scripts
Find all machines on the current domain where the current user has local admin access (This function queries the DC of the current or provided domain for a list of computers (Get-NetComputer) and then use multi-threaded Invoke-CheckLocalAdminAccess on each machine. Logon events for all machines, loud!)
PowerView
Copy Find-LocalAdminAccess –Verbose
Alternative: Find-WMILocalAdminAccess.ps1
Find local admins on all machines of the domain (needs administrator privs on non-dc machines). (This function queries the DC of the current or provided domain for a list of computers (Get-NetComputer) and then use multi-threaded GetNetLocalGroup on each machine.)
PowerView
Copy Invoke-EnumerateLocalAdmin –Verbose
Find computers where a domain admin (or specified user/group) has sessions. (This function queries the DC of the current or provided domain for members of the given group (Domain Admins by default) using Get-NetGroupMember, gets a list of computers (Get-NetComputer) and list sessions and logged on users (GetNetSession/Get-NetLoggedon) from each machine).
PowerView
Copy Invoke-UserHunter
Invoke-UserHunter -GroupName "RDPUsers"
Confirm admin access
PowerView
Copy Invoke-UserHunter -CheckAccess
Find computers where a domain admin is logged-in. (This option queries the DC of the current or provided domain for members of the given group (Domain Admins by default) using GetNetGroupMember, gets a list only of high traffic servers (DC, File Servers and Distributed File servers) for less traffic generation and list sessions and logged on users (Get-NetSession/Get-NetLoggedon) from each machine.)
PowerView
Copy Invoke-UserHunter -Stealth
PrivEsc
Unconstrained Delegation
PowerView ADModule
Copy Get-NetComputer -UnConstrained
Get-DomainUser -AllowDelegation -AdminCount
Copy Get-ADComputer -Filter {TrustedForDelegation -eq $True}
Get-ADUser -Filter {TrustedForDelegation -eq $True}
Constrained Delegation
PowerView ADModule
Copy Get-DomainUser –TrustedToAuth
Get-DomainComputer –TrustedToAuth
Copy Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo
ASREP Roasting
PowerView ADModule
Copy Get-DomainUser -PreauthNotRequired -Verbose
Copy Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} Properties DoesNotRequirePreAuth
Clear Passwords
PowerView
Copy $FormatEnumerationLimit=-1;Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword | % {Add-Member -InputObject $_ NoteProperty 'Password' "$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru} | fl